3 ms·

"Do we trust the WhatsApp server?" -- could be also formulated as: "Do we trust the WhatsApp client?". It is obviously made by the same people. Both are closed

by ktpsns 9y ago

"Do we trust the WhatsApp server?" -- could be also formulated as: "Do we trust the WhatsApp client?". It is obviously made by the same people. Both are closed source and the protocol is reverse engineered. What's the point if they made an auditing but do not communicate the results? It's probably not too surprising if reverse engineering points out vulnerabilities. It's a fenced ecosystem which claims to establish a secure communication but does not.

sasas 9y ago
> It's a fenced ecosystem which claims to establish a secure communication but does not. Your concern extends for all systems that require centralisation. Possibly one example of a chat client which addresses the concerns you raise is Ricochet [1]. Your Ricochet messaging client instance acts as a Tor hidden service. Your add contacts by their ricochet ID which is derived from an onion address. There is no central server / service involved. Everything is direct p2p between your messaging client and your peers. The source code has been audited by NCC group [2]. It's limited - text only, no attachments, no voice. If your threat model includes adversaries such as nation states, then this is perhaps the tool to use for simple text messaging. [1] https://ricochet.im/ https://ricochet.im/ [2] https://ricochet.im/files/ricochet-ncc-audit-2016-01.pdf https://ricochet.im/files/ricochet-ncc-audit-2016-01.pdf
george3383 9y ago
Having an open source client and server would help how? How would you know the server is running that software? Or that the binaries distributed via the App Store don't have some special spice? And as far as I know the whatsapp protocol is simply tokenised XMPP.
- Karliss 9y ago
  If you have proper end to end encryption protocol and client which correctly implements the protocol without additional backdoors then it doesn't matter what the server runs. If the client is open source you can verify and build it yourself or download the binary from source that you trust.

by ktpsns 9y ago

sasas 9y ago

> It's a fenced ecosystem which claims to establish a secure communication but does not. Your concern extends for all systems that require centralisation. Possibly one example of a chat client which addresses the concerns you raise is Ricochet [1]. Your Ricochet messaging client instance acts as a Tor hidden service. Your add contacts by their ricochet ID which is derived from an onion address. There is no central server / service involved. Everything is direct p2p between your messaging client and your peers. The source code has been audited by NCC group [2]. It's limited - text only, no attachments, no voice. If your threat model includes adversaries such as nation states, then this is perhaps the tool to use for simple text messaging. [1] https://ricochet.im/ https://ricochet.im/ [2] https://ricochet.im/files/ricochet-ncc-audit-2016-01.pdf https://ricochet.im/files/ricochet-ncc-audit-2016-01.pdf

george3383 9y ago

Having an open source client and server would help how? How would you know the server is running that software? Or that the binaries distributed via the App Store don't have some special spice? And as far as I know the whatsapp protocol is simply tokenised XMPP.

Karliss 9y ago
If you have proper end to end encryption protocol and client which correctly implements the protocol without additional backdoors then it doesn't matter what the server runs. If the client is open source you can verify and build it yourself or download the binary from source that you trust.